Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 00:10

General

  • Target

    DepthsRevivals.exe

  • Size

    6.1MB

  • MD5

    4864a55cff27f686023456a22371e790

  • SHA1

    6ed30c0371fe167d38411bfa6d720fcdcacc4f4c

  • SHA256

    08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2

  • SHA512

    4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb

  • SSDEEP

    98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe
    "C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe
      "C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"
      2⤵
        PID:3024
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f
          3⤵
          • Adds Run key to start application
          PID:2660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2916-1-0x00000000102E6000-0x0000000010300000-memory.dmp

      Filesize

      104KB

    • memory/2916-0-0x0000000010000000-0x0000000012DA5000-memory.dmp

      Filesize

      45.6MB

    • memory/2916-14-0x0000000010000000-0x0000000012DA5000-memory.dmp

      Filesize

      45.6MB

    • memory/2916-10-0x0000000010000000-0x0000000012DA5000-memory.dmp

      Filesize

      45.6MB

    • memory/3024-15-0x00000000001C0000-0x0000000000214000-memory.dmp

      Filesize

      336KB

    • memory/3024-12-0x00000000001C0000-0x0000000000214000-memory.dmp

      Filesize

      336KB

    • memory/3024-11-0x00000000001C0000-0x0000000000214000-memory.dmp

      Filesize

      336KB

    • memory/3024-8-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

    • memory/3024-6-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

    • memory/3024-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/3024-2-0x00000000001C0000-0x0000000000214000-memory.dmp

      Filesize

      336KB